CVE-2021-23901

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML data. It often allows an attacker to view files on the application server filesystem, and to interact with any back-end or external systems that the application itself can access. This issue is fixed in Apache Nutch 1.18.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-611

Affected software

VendorProductVersions
Apache Software FoundationApache Nutch>= Apache Nutch, <= 1.17

References

Timeline

Published
Jan 25, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-239066.8An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A Message Length is notCVE-2021-239079.8An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The count in MultiSvGetCVE-2021-239089.8An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A type confusion issue CVE-2021-239099.8An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The SH2 MCU allows remote codeCVE-2021-23918.8Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Scheduler). Supported versions that are affected arCVE-2021-239109.8An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. There is an out-of-bounds arraCVE-2021-23928.8Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: BI Publisher Security). Supported versions that areCVE-2021-239219.1An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elements.CVE-2021-239225.4An issue was discovered in Devolutions Remote Desktop Manager before 2020.2.12. There is a cross-site scripting (XSS) vulnerability in webviCVE-2021-239238.1An issue was discovered in Devolutions Server before 2020.3. There is Broken Authentication with Windows domain users.CVE-2021-239247.5An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files.CVE-2021-239256.1An issue was discovered in Devolutions Server before 2020.3. There is a cross-site scripting (XSS) vulnerability in entries of type Document
CVE-2021-23901: Critical severity, CVSS 9.1 | Vulnix